{
# Pin down nixpkgs from github, instead of using global, system or user registries.
inputs.nixpkgs.url = "github:NixOS/nixpkgs/32096899af23d49010bd8cf6a91695888d9d9e73";
#inputs.nixpkgs.url = "flake:nixpkgs";
inputs.flake-utils.url = "github:numtide/flake-utils";
inputs.home-manager.follows = "julm-nix/home-manager";
#inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
inputs.julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
#inputs.julm-nix.type = "path";
#inputs.julm-nix.path = "/home/julm/work/sourcephile/nix/julm-nix";
inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
inputs.doom-emacs.follows = "julm-nix/doom-emacs";
inputs.shell.url = "path:./shell";
inputs.shell.flake = false;
inputs.pass.type = "path";
inputs.pass.path = "/home/julm/work/sourcephile/nix/pass";
inputs.pass.flake = false;

outputs = inputs: let
  remoteNixpkgsPatches = import nixpkgs/patches.nix;
  localNixpkgsPatches = [
    #nixpkgs/patches/sourcehut.diff
    #nixpkgs/patches/bitmask.diff
    #nixpkgs/patches/systemd-coredump.diff
  ];
  originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  nixpkgsPath = originPkgs.applyPatches {
    name = "nixpkgs-patched";
    src = inputs.nixpkgs;
    patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
    postPatch = ''
      patch=$(printf '%s\n' ${builtins.concatStringsSep " "
         (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
        sort | sha256sum | cut -c -7)
      echo "+patch-$patch" >.version-suffix
    '';
  };
  lib = originPkgs.lib;
  hosts = builtins.mapAttrs (hostName: hostConfig:
    let cfg = import hostConfig { inherit inputs hostName nixpkgsPath; }; in
    import (nixpkgsPath + "/nixos/lib/eval-config.nix") (lib.recursiveUpdate cfg {
      specialArgs = {
        inherit hostName inputs;
      };
      modules = cfg.modules ++ [
        {
          config._module.args = {
            hosts = inputs.self.nixosConfigurations;
            host = inputs.self.nixosConfigurations.${hostName}._module.args;
          };
        }
        inputs.home-manager.nixosModules.home-manager
        {
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.verbose = true;
          home-manager.backupFileExtension = null;
          home-manager.extraSpecialArgs = {
            inherit hostName inputs;
          };
        }
        ({ pkgs, ... }: {
          nix.package = pkgs.nixUnstable;
          nixpkgs.overlays =
            import nixpkgs/overlays.nix ++
            import (inputs.julm-nix + "/nixpkgs/overlays.nix");
          system.nixos.versionSuffix = ".${
            lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
            inputs.self.shortRev or "dirty"}";
          system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
          # Let 'nixos-version --json' know about the Git revision of this flake.
          system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
          /*
          system.configurationRevision =
            if inputs.self ? rev
            then inputs.self.rev
            else throw "Refusing to build from a dirty Git tree!";
          */
          programs.ssh.knownHosts = {
            carotte = {
              extraHostNames = [ "carotte" "carotte.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
            };
            mermet = {
              extraHostNames = [ "mermet" "mermet.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
            };
            losurdo = {
              extraHostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
            };
          };
        })
      ];
    }));
  in
  {
    # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
    # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
    # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
    # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
    nixosConfigurations = hosts {
      carotte = hosts/carotte.nix;
      losurdo = hosts/losurdo.nix;
      mermet  = hosts/mermet.nix;
    };
    #nixosModule = import nixos/modules.nix;
  }
  // inputs.flake-utils.lib.eachDefaultSystem (system:
    #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
    let
      pkgs = import nixpkgsPath {
        inherit system;
        overlays =
          import nixpkgs/overlays.nix ++
          import (inputs.julm-nix + "/nixpkgs/overlays.nix");
      };
    in {
    legacyPackages = pkgs;
    devShell = import ./shell.nix { inherit inputs pkgs; };
    apps = builtins.mapAttrs (hostName: { config, ... }: let
      build = config.system.build;
      target = "\"\${TARGET:-root@${config.networking.hostName}.${config.networking.domain}}\"";
      profile = "/nix/var/nix/profiles/system";
      in rec {
      # Example: nix run .#losurdo.switch
      "switch" = {
        type = "app";
        program = (pkgs.writeShellScript "switch" (''
          set -eux
          set -o pipefail
          shopt -s globstar
          nix-store --add-root hosts/${hostName}.nixpkgs --indirect --realise ${nixpkgsPath}
          nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}

          nix copy --to ssh://${target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}

          '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
          # Send the SSH key of the initrd
          gpg --decrypt 'pass/hosts/${hostName}/initrd/ssh.key.gpg' |
          ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
          # Send the Wireguard key of the initrd
          gpg --decrypt 'pass/hosts/${hostName}/wireguard/wg-intra/privateKey.gpg' |
          ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
          '' + ''
          ssh ${target} set -x ';' \
            systemctl reset-failed nixos-fallback '2>/dev/null' ';' \
            systemd-run -u nixos-fallback --description=nixos-fallback /bin/sh -xc '''\'''
              PATH=${with pkgs; lib.makeBinPath [ coreutils nix systemd ]}
              sleep $((10 * 60))
              ${profile}/bin/switch-to-configuration switch
              systemctl reboot
            '\'''' '&&' \
            ${build.toplevel}/bin/switch-to-configuration test

          ssh ${target} -o ControlPath=none set -x ';' \
            systemctl stop nixos-fallback.service ';' \
            nix-env --profile ${profile} --set '${build.toplevel}' ';' \
            ${build.toplevel}/bin/switch-to-configuration boot '&&' \
            nix-env --delete-generations 7d --profile ${profile}
          ''
        )).outPath;
      };
      # Example: nix run .#carotte.install-sd
      "install-sd" = {
        type = "app";
        program = (pkgs.writeShellScript "install-sd" ''
          export PATH="$PATH:${with pkgs; lib.makeBinPath [coreutils zstd]}"
          set -eux
          set -o pipefail
          nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
          unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
          sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
        '').outPath;
      };
    }) inputs.self.nixosConfigurations;}
  );
}